这是一个创建于 1511 天前的主题，其中的信息可能已经有所发展或是发生改变。
5064 是我的 Chrome, 为什么他往外网机器的 480 端口发 SYN_SENT 啊？
=================================
C:\Users\Administrator>netstat -no
活动连接
协议 本地地址 外部地址 状态 PID
TCP 127.0.0.1:1028 127.0.0.1:5354 ESTABLISHED 1808
TCP 127.0.0.1:1029 127.0.0.1:5354 ESTABLISHED 1808
TCP 127.0.0.1:1036 127.0.0.1:27015 ESTABLISHED 3784
TCP 127.0.0.1:5354 127.0.0.1:1028 ESTABLISHED 1892
TCP 127.0.0.1:5354 127.0.0.1:1029 ESTABLISHED 1892
TCP 127.0.0.1:27015 127.0.0.1:1036 ESTABLISHED 1808
TCP 192.168.12.9:12052 203.208.41.65:443 LAST_ACK 5064
TCP 192.168.12.9:12145 183.146.212.137:443 FIN_WAIT_1 5064
TCP 192.168.12.9:12146 120.92.82.179:443 ESTABLISHED 5064
TCP 192.168.12.9:12147 154.8.214.239:7823 ESTABLISHED 5064
TCP 192.168.12.9:12150 119.3.229.89:443 ESTABLISHED 5064
TCP 192.168.12.9:12151 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12152 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12153 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12155 59.45.75.31:480 SYN_SENT 5064
TCP 192.168.12.9:12156 59.45.75.31:480 SYN_SENT 5064
TCP 192.168.12.9:12157 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12158 106.40.241.42:480 SYN_SENT 5064
TCP 192.168.12.9:12159 106.40.241.42:480 SYN_SENT 5064
TCP 192.168.12.9:14658 108.177.97.188:443 ESTABLISHED 5064
=================================
C:\Users\Administrator>netstat -no
活动连接
协议 本地地址 外部地址 状态 PID
TCP 127.0.0.1:1028 127.0.0.1:5354 ESTABLISHED 1808
TCP 127.0.0.1:1029 127.0.0.1:5354 ESTABLISHED 1808
TCP 127.0.0.1:1036 127.0.0.1:27015 ESTABLISHED 3784
TCP 127.0.0.1:5354 127.0.0.1:1028 ESTABLISHED 1892
TCP 127.0.0.1:5354 127.0.0.1:1029 ESTABLISHED 1892
TCP 127.0.0.1:27015 127.0.0.1:1036 ESTABLISHED 1808
TCP 192.168.12.9:12052 203.208.41.65:443 LAST_ACK 5064
TCP 192.168.12.9:12145 183.146.212.137:443 FIN_WAIT_1 5064
TCP 192.168.12.9:12146 120.92.82.179:443 ESTABLISHED 5064
TCP 192.168.12.9:12147 154.8.214.239:7823 ESTABLISHED 5064
TCP 192.168.12.9:12150 119.3.229.89:443 ESTABLISHED 5064
TCP 192.168.12.9:12151 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12152 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12153 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12155 59.45.75.31:480 SYN_SENT 5064
TCP 192.168.12.9:12156 59.45.75.31:480 SYN_SENT 5064
TCP 192.168.12.9:12157 121.57.211.3:480 SYN_SENT 5064
TCP 192.168.12.9:12158 106.40.241.42:480 SYN_SENT 5064
TCP 192.168.12.9:12159 106.40.241.42:480 SYN_SENT 5064
TCP 192.168.12.9:14658 108.177.97.188:443 ESTABLISHED 5064
第 1 条附言 · 2020-11-08 22:15:34 +08:00
试了好几天 已经抓不到 480 端口的记录了。 所以 没法继续调查
7 条回复 • 2020-11-08 11:23:04 +08:00
 |
1
fiveelementgid 2020-11-07 12:20:16 +08:00 via Android
善用
cat /etc/services | grep -i -n "480" |
 |
2
johnsonshu OP @fiveelementgid 我是 windows 啊， 只知道 480 不是知名端口。但不知道为什么浏览器要去连接这个端口。
|
|
3
fiveelementgid 2020-11-07 12:38:07 +08:00 via Android
|
 |
4
zhangsanfeng2012 2020-11-07 14:17:17 +08:00  1
chrome://net-export
导出 log 看看是谁发起的 |
 |
5
unixeno 2020-11-07 16:17:48 +08:00 via Android
Wireshark 抓包看看呗
|
 |
6
widewing 2020-11-07 16:28:17 +08:00 via Android
自定义的 http 端口呗。
返回[40BAB94CDB8231B6FDE08656DC1D269A][E1]Not allowed to access builtin services, try ServerOptions.internal_port=22333 instead if you're in internal network |
 |
7
ChangeTheWorld 2020-11-08 11:23:04 +08:00 via Android 1
Bilibili 的 mcdn 似乎用 480 端口
|
Select Language